Cereal2 · Observed attack

AS61754 UDP flood on 143.202.52.0/24 | 2026-10-13 22:49:35Z

· Event #328895

WhatsApp

Country-level precision. botnet.cl stores the target country, never a city or coordinates, so the marker sits at the country's center.

What this method does

Cereal2 vector 19: Configurable custom-payload UDP flood.

All Configurable custom-payload UDP flood observations
Observed
2026-10-13T22:49:35.048Z
Recorded

Recorded 151ms after observation

Affected network
143.202.52.0/24
Network operator
I3 Telecomunicacoes - EIRELIAS61754
Location
Brazil
Method
Configurable custom-payload UDP floodVector 19
Protocol
udp
Destination port
Randomized
Commanded duration
1m
Observed via
101.34.239.216119.45.12.154170.106.35.19743.136.129.13143.153.106.22943.156.101.22843.157.198.13743.159.46.15543.173.37.5377.232.43.2182.157.209.4194.183.235.1194.183.235.14294.183.235.15995.182.87.134

All controllers with retained sightings of this order. Older records may have incomplete source coverage.

Geolocation data
ipinfo-lite · 2026-09

Snapshot taken at ingestion; it is never re-resolved later.

Payload observed in C2 command

Observed command data; this does not establish what reached the target.

Custom payload · 32 bytes

Decoded template · 32 bytes

OffsetHexadecimalASCII
00000000e3 4b 24 9b ef 9b 7e bc.K$...~.
0000000870 5e 99 0e 68 d4 9a 80p^..h...
0000001038 46 1e 17 39 e8 71 538F..9.qS
00000018f3 68 3e 8e ad f6 5a f8.h>...Z.

8 or 16 bytes per row, depending on screen width. Dots represent non-printable bytes.

SHA-256 of decoded template

487d6e23e1ea3b5f1cb0c36347f98bcdbbcf73eef801c09ac88765a43312a2de

Configured datagram length
1400 bytes
Minimum length option
1000 bytes
Maximum length option
1400 bytes

Length options are command settings, not measured packet sizes. The decoded template can differ from the resulting datagrams.

Original encoded value
e34b249bef9b7ebc705e990e68d49a8038461e1739e87153f3683e8eadf65af8

Original bytes (Base64)

ZTM0YjI0OWJlZjliN2ViYzcwNWU5OTBlNjhkNDlhODAzODQ2MWUxNzM5ZTg3MTUzZjM2ODNlOGVhZGY2NWFmOA==

Other attacks on this network

Within 24 hours of this observation

Other attacks in this country

Within 24 hours of this observation

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.